CIRCL
/
AIL-framework
mirror of https://github.com/CIRCL/AIL-framework
2
1
Fork 0
Code Issues Releases Wiki Activity

chg: [MISP Importer] files: handle missing sha1/sha256 attributes + fix Items and Screenshots dir

pull/486/head
Terrtia 2020-02-26 13:45:47 +01:00
parent 5ae22ec216
commit 40b853cbe3
No known key found for this signature in database
GPG Key ID: 1E1B1F50D84613D0
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
bin/export/MispImport.py
View File

@ -6,6 +6,8 @@ import sys
import uuid import uuid
import redis import redis
from hashlib import sha1, sha256
sys.path.append(os.path.join(os.environ['AIL_BIN'], 'lib')) sys.path.append(os.path.join(os.environ['AIL_BIN'], 'lib'))
sys.path.append(os.path.join(os.environ['AIL_BIN'], 'packages')) sys.path.append(os.path.join(os.environ['AIL_BIN'], 'packages'))
import Item import Item
@ -168,6 +170,13 @@ def unpack_file(map_uuid_global_id, misp_obj):
elif attribute.object_relation == 'sha256' and obj_type == 'screenshot': elif attribute.object_relation == 'sha256' and obj_type == 'screenshot':
obj_id = attribute.value obj_id = attribute.value
# get SHA1/sha256
if io_content and not obj_id:
if obj_type=='screenshot':
obj_id = sha256(io_content.getvalue()).hexdigest()
else: # decoded file
obj_id = sha1(io_content.getvalue()).hexdigest()
if obj_id and io_content: if obj_id and io_content:
obj_meta = get_object_metadata(misp_obj) obj_meta = get_object_metadata(misp_obj)
if obj_type == 'screenshot': if obj_type == 'screenshot':
@ -234,7 +243,7 @@ if __name__ == '__main__':
# misp = PyMISP('https://127.0.0.1:8443/', 'uXgcN42b7xuL88XqK5hubwD8Q8596VrrBvkHQzB0', False) # misp = PyMISP('https://127.0.0.1:8443/', 'uXgcN42b7xuL88XqK5hubwD8Q8596VrrBvkHQzB0', False)
import_objs_from_file('test_import_item.json') import_objs_from_file('ail_export_c777a4d1-5f63-4fa2-86c0-07da677bdac2.json')
#Screenshot.delete_screenshot('a92d459f70c4dea8a14688f585a5e2364be8b91fbf924290ead361d9b909dcf1') #Screenshot.delete_screenshot('a92d459f70c4dea8a14688f585a5e2364be8b91fbf924290ead361d9b909dcf1')
#Decoded.delete_decoded('d59a110ab233fe87cefaa0cf5603b047b432ee07') #Decoded.delete_decoded('d59a110ab233fe87cefaa0cf5603b047b432ee07')

4
bin/lib/Screenshot.py
View File

@ -169,6 +169,10 @@ def save_screenshot_file(sha256_string, io_content):
if os.path.isfile(filepath): if os.path.isfile(filepath):
#print('File already exist') #print('File already exist')
return False return False
# create dir
dirname = os.path.dirname(filepath)
if not os.path.exists(dirname):
os.makedirs(dirname)
# # TODO: check if is IO file # # TODO: check if is IO file
with open(filepath, 'wb') as f: with open(filepath, 'wb') as f:
f.write(io_content.getvalue()) f.write(io_content.getvalue())

4
bin/packages/Item.py
View File

@ -353,6 +353,10 @@ def save_raw_content(item_id, io_content):
if os.path.isfile(filepath): if os.path.isfile(filepath):
#print('File already exist') #print('File already exist')
return False return False
# create subdir
dirname = os.path.dirname(filepath)
if not os.path.exists(dirname):
os.makedirs(dirname)
# # TODO: check if is IO file # # TODO: check if is IO file
with open(filepath, 'wb') as f: with open(filepath, 'wb') as f:
f.write(io_content.getvalue()) f.write(io_content.getvalue())